Cisco CLI Fun- How to enable SSH on a Cisco Router — 2015-10-09

So by default on many IOS devices you can access via console cable or telnet, but telnet is not secure, luckily many cisco devices will support ssh, provided you set it up.

Note- some older devices don’t allow ssh. In my lab I didn’t have settings in any Catalyst 35xx devices or example.

I’ll break it down into the steps, if you have any of these already configured you can skip where you like.

Step 1 – Set a Hostname and domain.

The RSA key you will generate later needs a hostname and a domain since it’s a requirement.

Set a host name with:RTR(config)#hostname bob

Set a domain with:bob(config)#ip domain name bob.local

This would set the host+domain to bob.bob.local

Step 2 – Generate an RSA Key

The RSA key is the same as the SSL keys you exchange when you use a web page via https.

bob(config)#crypto key generate rsa general-keys

you will be prompted for the bit strength of the key and the default is 512. I use 1024, you can use more, keep in mind everything increases the larger you go.

If you already have a key you will be warned to overwrite it.

If you ever change the hostname or domain you will need to generate a new key.

Step 3 – Create a user with higher privilege.

You don’t actually have to use higher privilege, but I do, simply because you can use this with SDM should you wish to in that java hell, and because I don’t want to remember enable secrets because i’m lazy 😀

bob(config)#username bob privilege 15 secret Y0urM0m

bob is the username, the password is stored encrypted as Y0urM0m.

Step 4 – Setup your Virtual Terminals

bob(config)#line vty 0 15

bob(config-line)#login local

bob(config-line)#transport input ssh.

This tells VTY to use the username you setup, and allows only ssh to be used over vty. It’s helpful to not close the Telnet session you have open while you test the ssh settings.. lest you forgot the password or well.. anything.. that would have you running to the device with a console cable.